Maneuver Safing Notes

Last Update: 11 May 2007
file on SOC in /u/ecs/soc/SVM/safing.html AND on spot at public_html/safing.html

General Notes:

Instrument Safing and Recovery activities are in the FOT's Maneuver Prep and Maneuver End scripts.
The offpointing flag is disabled during maneuvers.
When CDS and UVCS safe themselves, some limit violations will be expected both during the safing process and while the instruments are in this safe configuration. They should submit a list of violations to ignore each maneuver.

CDS Before After LASCO closes their doors, CDS will close both doors (GIS and NIS) via NRT commanding. Actual door closure takes 10 minutes of NRT. Usually set aside 30 minutes for CDS to prepare. Should ask to be removed from ESR flag warning function.

After Wait more than 24 hours once the burns are complete before returning to nominal operations via NRT. If CDS was removed from ESR function, re-enable them.

Notes In the event of an operator emergency in which a CDS operator is not present at the EOF to close the doors, the following commands are to be sent via FOT with 30 second interval pauses between each command, which should close the doors with no problems:
CBMDRINI
CBMPMDN
CBMDVCT
CBMDGCT
CBMPMDF
These instructions are formalized in OCD#463 on file to be used in event the operator is unable to be here to safe the instrument themselves. Some CDS representative must be reachable by phone prior to execution.

CELIAS
CTOF Before Typically CTOF will only safe if the fuel estimate of the burns is > 1500 grams. Will safe via delayed command load.

After Recovers via delayed command load.

Notes No standard safing/recovery files exist - SOC must ask CTOF for them.

CELIAS
MTOF Before Will safe prior to a maneuver ONLY if the fuel estimate of the burns is > 1500 grams. Safing is performed using NRT.

After Recovers via NRT commanding.

Notes The TSTOL procedure f_fl_m_safe could be used to safe MTOF, but has never been used operationally to date. There is no way to "automate" their recovery -- as the recovery procedure depends on current solar wind conditions. There also exist RCR's: f_mtof_safe.pcs and f_mtof_mcp110.pcs
No standard safing/recovery files exist - SOC must ask MTOF for them.

CELIAS
STOF Before Will safe prior to most maneuver activities via a delayed command load. FOT will confirm CELIAS is safe (Maneuver Preparation Script, Step 3). Lately, they have used the CEL_ESR_SAFE.DEL for routine maneuvers.

After Recovers via delayed command load (currently CEL11_RECOVR.DEL, 31 January 2006, or an ad hoc load for each specific case) 6 hours after burns.

Notes Have been using CEL_ESR_SAFE.DEL for safing lately, but may also choose to send a normal load. A standard recovery file does exist (CEL#_RECOVER.DEL), but they sometimes choose to do a normal load instead. The ESR Safing script (CEL_ESR_SAFE.DEL) may be used for emergency maneuvers (confirmed 25-DEC-2001 by Martin Hilchenbach).

CEPAC Not sensitive to thruster operations. If MDI closes its door, LION needs to be turned off first.

GOLF Not sensitive to thruster operations.

LASCO Before Will close the C2 and C3 doors via NRT commanding. At least thirty minutes of NRT commanding is required. LASCO will close their doors prior to CDS closing their doors. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though the team may request disabling at another time via RPR or OCD. May ask to be removed from ESR flag warning function.

After Usually opens their doors via NRT 24 hours after the burns are complete and additionally until 1 hour after CDS opens their doors. LASCO is to be added to the experiment off-pointing function following the burns, but prior to opening their doors (Maneuver End, Step 5). If LASCO was removed from ESR function, re-enable them.

Notes Door opening/closing is co-ordinated with CDS so to avoid insulation particles thrown from (or shaken loose by) CDS when CDS closes their doors.
If the LASCO operator is not present, the FOT can send the following procedure: l_set_esr to close the LASCO doors - however a LASCO representative should be contacted via phone prior.

EIT Not sensitive to thruster operations.

MDI Before The MDI ISS loop must be opened prior to any thruster activities. This can be performed either via NRT commanding, or by the FOT after notifying MDI team (Maneuver Preparation Script, Step 4). The experiment offpoint warning function is disabled in the next script line. This should only be done after the ISS loop is open.

After After the offpoint flag has been enabled (Maneuver End Script, Step 5), the MDI ISS loop should be closed. This can be performed either via NRT commanding, or by the FOT, upon MDI approval.

Notes VC2 telemetry is * not * required to open and close the ISS loop.
TSTOL procedures that can be used for opening/closing the ISS loop are: m_fl_issopen, m_fl_issclos.
In the past, MDI used to perform "jitter tests" during momentum managements which required VC2 telemetry and NRT for them to command and manually open their loop. These jitter tests are no longer performed.
MDI may need VC2 to do a leg alignment before closing ISS loop.

SUMER Before Will close aperture door and turn detector high voltage off, via NRT commanding. Thirty minutes of NRT is needed if enabled. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though a team may request disabling at another time via RPR or OCD.

After If resuming observations, SUMER should be added to the experiment off-pointing function (Maneuver End Script, Step 5). Opens door and turns on detector high voltage no sooner than 12 - 24 hours after the last burn, depending on the amount of fuel used. At least 30 minutes of NRT commanding is needed.

Notes If SUMER operator is not present, the FOT can send the following command: /SBSESR . This mimics an ESR response and is preferred rather than the other procedures: s_fl_safe and s_fl_emergen . However, this is "not official" and we should have SUMER write an OCD for this, if an early morning safing should ever occur again (doubtful).

SWAN Before If SK/MM are done: will be placed in launch lock position using the TSTOL procedure n_fl_llockin and will use ESR limit set (Maneuver Preparation Script, Step 3). IF ONLY A ROLL WILL HAPPEN, skip all this.

After If SK/MM are done: no sooner than 2 hours after the last burn, return to nominal limit set, run TSTOL procedure n_fl_llockout, and run TSTOL procedure n_fl_manrec (Maneuver End Script, Step 6).

Notes If SWAN has a bad motor offset they can send a delayed command to put them in IDLE (with the heaters still on) and then they can send a delayed command to restart things - SOC would do OCD's

UVCS Before Will safe the instrument via NRT commanding. Usually 45 minutes is necessary. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though a team may request disabling at another time via RPR or OCD. If UVCS leaves the door open, the ESR flag should remain enabled. If UVCS closes the door, the ESR flag should be disabled.
Typical safing includes rolling the instrument to align the long axis of the aperture with the S/C Z-axis and placing it on the outer edge of the instrument. Additionally, they will move the occulter and the mirror to a safe position, ramp down the detectors and turn off the high voltage power supplies. UVCS may also partially or completely close their door.

After The experiment off-pointing warning flag is re-enabled after maneuvers are completed (Maneuver End Script, Step 5). UVCS resumes normal observations using NRT commanding once all SVM activities are complete. (Around 30 minutes to recover plus additional time for loading science plan). If the ESR flag was disabled, it should be re-enabled before recovery can begin.

Notes In this past, the following was done: Due to the expected S/C sun-center off-set during past momentum management maneuvers, the UVCS sun-sensors are expected to trigger the safing loop that switches the UVCS s/w mode from OPS to SAFE. This safing loop will be left armed during the momentum management for test purposes. At the time that the loop will activate, no change in the UVCS status will occur, in that the instrument will be already in safe configuration (e.g., HVPS off). However, for test purposes, they like to check the change of s/w mode (TLM mnemonic: USMD) in their telemetry data.

VIRGO Not sensitive to thruster operations.
Note: If VIRGO ever wanted to close SPM and PMO covers, the FOT would run the procedure v_fl_covclose.prc

CDS	Before	After LASCO closes their doors, CDS will close both doors (GIS and NIS) via NRT commanding. Actual door closure takes 10 minutes of NRT. Usually set aside 30 minutes for CDS to prepare. Should ask to be removed from ESR flag warning function.
	After	Wait more than 24 hours once the burns are complete before returning to nominal operations via NRT. If CDS was removed from ESR function, re-enable them.
	Notes	In the event of an operator emergency in which a CDS operator is not present at the EOF to close the doors, the following commands are to be sent via FOT with 30 second interval pauses between each command, which should close the doors with no problems: CBMDRINI CBMPMDN CBMDVCT CBMDGCT CBMPMDF These instructions are formalized in OCD#463 on file to be used in event the operator is unable to be here to safe the instrument themselves. Some CDS representative must be reachable by phone prior to execution.
CELIAS CTOF	Before	Typically CTOF will only safe if the fuel estimate of the burns is > 1500 grams. Will safe via delayed command load.
	After	Recovers via delayed command load.
	Notes	No standard safing/recovery files exist - SOC must ask CTOF for them.
CELIAS MTOF	Before	Will safe prior to a maneuver ONLY if the fuel estimate of the burns is > 1500 grams. Safing is performed using NRT.
	After	Recovers via NRT commanding.
	Notes	The TSTOL procedure f_fl_m_safe could be used to safe MTOF, but has never been used operationally to date. There is no way to "automate" their recovery -- as the recovery procedure depends on current solar wind conditions. There also exist RCR's: f_mtof_safe.pcs and f_mtof_mcp110.pcs No standard safing/recovery files exist - SOC must ask MTOF for them.
CELIAS STOF	Before	Will safe prior to most maneuver activities via a delayed command load. FOT will confirm CELIAS is safe (Maneuver Preparation Script, Step 3). Lately, they have used the CEL_ESR_SAFE.DEL for routine maneuvers.
	After	Recovers via delayed command load (currently CEL11_RECOVR.DEL, 31 January 2006, or an ad hoc load for each specific case) 6 hours after burns.
	Notes	Have been using CEL_ESR_SAFE.DEL for safing lately, but may also choose to send a normal load. A standard recovery file does exist (CEL#_RECOVER.DEL), but they sometimes choose to do a normal load instead. The ESR Safing script (CEL_ESR_SAFE.DEL) may be used for emergency maneuvers (confirmed 25-DEC-2001 by Martin Hilchenbach).
CEPAC		Not sensitive to thruster operations. If MDI closes its door, LION needs to be turned off first.
GOLF		Not sensitive to thruster operations.
LASCO	Before	Will close the C2 and C3 doors via NRT commanding. At least thirty minutes of NRT commanding is required. LASCO will close their doors prior to CDS closing their doors. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though the team may request disabling at another time via RPR or OCD. May ask to be removed from ESR flag warning function.
	After	Usually opens their doors via NRT 24 hours after the burns are complete and additionally until 1 hour after CDS opens their doors. LASCO is to be added to the experiment off-pointing function following the burns, but prior to opening their doors (Maneuver End, Step 5). If LASCO was removed from ESR function, re-enable them.
	Notes	Door opening/closing is co-ordinated with CDS so to avoid insulation particles thrown from (or shaken loose by) CDS when CDS closes their doors. If the LASCO operator is not present, the FOT can send the following procedure: l_set_esr to close the LASCO doors - however a LASCO representative should be contacted via phone prior.
EIT		Not sensitive to thruster operations.
MDI	Before	The MDI ISS loop must be opened prior to any thruster activities. This can be performed either via NRT commanding, or by the FOT after notifying MDI team (Maneuver Preparation Script, Step 4). The experiment offpoint warning function is disabled in the next script line. This should only be done after the ISS loop is open.
	After	After the offpoint flag has been enabled (Maneuver End Script, Step 5), the MDI ISS loop should be closed. This can be performed either via NRT commanding, or by the FOT, upon MDI approval.
	Notes	VC2 telemetry is * not * required to open and close the ISS loop. TSTOL procedures that can be used for opening/closing the ISS loop are: m_fl_issopen, m_fl_issclos. In the past, MDI used to perform "jitter tests" during momentum managements which required VC2 telemetry and NRT for them to command and manually open their loop. These jitter tests are no longer performed. MDI may need VC2 to do a leg alignment before closing ISS loop.
SUMER	Before	Will close aperture door and turn detector high voltage off, via NRT commanding. Thirty minutes of NRT is needed if enabled. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though a team may request disabling at another time via RPR or OCD.
	After	If resuming observations, SUMER should be added to the experiment off-pointing function (Maneuver End Script, Step 5). Opens door and turns on detector high voltage no sooner than 12 - 24 hours after the last burn, depending on the amount of fuel used. At least 30 minutes of NRT commanding is needed.
	Notes	If SUMER operator is not present, the FOT can send the following command: /SBSESR . This mimics an ESR response and is preferred rather than the other procedures: s_fl_safe and s_fl_emergen . However, this is "not official" and we should have SUMER write an OCD for this, if an early morning safing should ever occur again (doubtful).
SWAN	Before	If SK/MM are done: will be placed in launch lock position using the TSTOL procedure n_fl_llockin and will use ESR limit set (Maneuver Preparation Script, Step 3). IF ONLY A ROLL WILL HAPPEN, skip all this.
	After	If SK/MM are done: no sooner than 2 hours after the last burn, return to nominal limit set, run TSTOL procedure n_fl_llockout, and run TSTOL procedure n_fl_manrec (Maneuver End Script, Step 6).
	Notes	If SWAN has a bad motor offset they can send a delayed command to put them in IDLE (with the heaters still on) and then they can send a delayed command to restart things - SOC would do OCD's
UVCS	Before	Will safe the instrument via NRT commanding. Usually 45 minutes is necessary. The experiment offpoint warning function is disabled (Maneuver Preparation Script, Step 4) before the maneuver, though a team may request disabling at another time via RPR or OCD. If UVCS leaves the door open, the ESR flag should remain enabled. If UVCS closes the door, the ESR flag should be disabled. Typical safing includes rolling the instrument to align the long axis of the aperture with the S/C Z-axis and placing it on the outer edge of the instrument. Additionally, they will move the occulter and the mirror to a safe position, ramp down the detectors and turn off the high voltage power supplies. UVCS may also partially or completely close their door.
	After	The experiment off-pointing warning flag is re-enabled after maneuvers are completed (Maneuver End Script, Step 5). UVCS resumes normal observations using NRT commanding once all SVM activities are complete. (Around 30 minutes to recover plus additional time for loading science plan). If the ESR flag was disabled, it should be re-enabled before recovery can begin.
	Notes	In this past, the following was done: Due to the expected S/C sun-center off-set during past momentum management maneuvers, the UVCS sun-sensors are expected to trigger the safing loop that switches the UVCS s/w mode from OPS to SAFE. This safing loop will be left armed during the momentum management for test purposes. At the time that the loop will activate, no change in the UVCS status will occur, in that the instrument will be already in safe configuration (e.g., HVPS off). However, for test purposes, they like to check the change of s/w mode (TLM mnemonic: USMD) in their telemetry data.
VIRGO		Not sensitive to thruster operations. Note: If VIRGO ever wanted to close SPM and PMO covers, the FOT would run the procedure v_fl_covclose.prc